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DETAILED ACTION 

Continued Examination Under 37 CFR 1.114 

1 . A request for continued examination under 37 CFR 1 .1 14, including the fee set 
forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.1 14, and the fee set 
forth in 37 CFR 1 .17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. 

Applicant's submission filed on 7/1 9/2007 has been entered. 

2. This action is responding to application papers filed 7-19-2007. Claims 1,2, 4, 
5, 7 - 11, 13, 14, 16 - 20, 22 - 25 are pending: Claims 1, 4, 5, 10, 13, 14, 19 have 
been amended. Claims 3, 6, 12, 15, 21 have been cancelled. Claims 1, 10, 19 are 
independent. 

Response to Arguments 

3. Applicant's arguments filed 7/1 9/2007 have been fully considered but they are not 
persuasive. 

3.1 Applicant argues that within the referenced prior art, "Moriconi does not disclose 
any distribution of policy decisions by the policy manager", (see Remarks Page 9) 

The Office Action does not state that Moriconi discloses, " a distribution of policy 
decisions by the policy manager". The claimed invention does not mention the term 



Application/Control Number: 10/608,882 Page 3 

Art Unit: 2136 

"policy manager". The Office Action does not have to disclose limitations that are not 
stated in the claimed invention. The citations in the Office Action state the limitations 
the Moriconi prior art discloses. 

3.2 Applicant argues that within the referenced prior art, " Singhal is completely silent 
regarding what happens if an application level policy at a policy decision point is 
changed that may affect a policy decision previously provided to the AIG". (see 
Remarks Page 10) 

The Office Action does not state that Singhal discloses, " what happens if an 
application level policy at a policy decision point is changed that may affect a policy 
decision previously provided to the AIG. The claimed invention does not mention the 
term "AIG". The Office Action does not have to disclose limitations that are not stated 
in the claimed invention. The citations in the Office Action state the limitations the 
Singhal prior art discloses. 

3.3 Applicant argues that the referenced prior art does not disclose, usage of 
hindsight, (see Remarks Page 11) 

In response to applicant's argument that the examiner's conclusion of obviousness 
is based upon improper hindsight reasoning, it must be recognized that any judgment 
on obviousness is in a sense necessarily a reconstruction based upon hindsight 
reasoning. But so long as it takes into account only knowledge which was within the 
level of ordinary skill at the time the claimed invention was made, and does not include 
knowledge gleaned only from the applicant's disclosure, such a reconstruction is proper. 
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See In re McLaughlin, 443 F.2d 1392, 170 USPQ 209 (CCPA 1971)'. 

The Moriconi prior art has already made the decision that the storage of policy 
decisions is advantageous over the storage of policy rules. The Singhal prior art 
discloses the capability to update policy rules and transfer the updated rules to remote 
nodes. The combined Moriconi and Singhal prior art combination discloses that the 
propagation of updated rules as updated policy decisions to enable the advantage of 
the usage of decisions over rules achieves a time saving advantage. This would be 
obvious to one skilled in the art. 

3.4 Applicant argues that the referenced prior art does not disclose, obviousness, 
(see Remarks Page 11-12) 

An achieved advantaged is a motivation for the combination of prior art references. 
The rejection to each independent and dependent claim includes a citation from the 
referenced prior art that discloses the basis for the rejection. Each obviousness 
combination clearly indicates the claim limitation the combined reference prior art 
teaches. In addition, a cited passage from the referenced prior art clearly indicates the 
motivation for the obviousness combination. Each obviousness combination's 
disclosure is equivalent to the Applicant's claimed invention. 

3.5 Based on the specification a notification is a distribution of updated security 
policy information. Applicant's specification indicates that notification is defined such 
that, " ... In one such embodiment, the notification also includes an updated version of 
the policy decision based on the change. and " ... In one embodiment, when a 
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policy definition is changed, the source (e.g., the policy server) sends out notifications to 
the PEPs, or at least to those PEPs that are affected by the change. (see 
Specification paragraph [0012]). 

The Moriconi prior art discloses the capability to send out a notification, or to 
distribute a set of updated version of the security policy information, (see Moriconi 
paragraph [0082], lines 8-13: distribute updated policy information) 

The Moriconi and Singhal prior art combination discloses the local memory storage 
and a remote source for security policy information, and the distributed environment of 
the Moriconi prior art discloses the remote storage of security policy information, (see 
Moriconi paragraph [0046], lines 3-9: distributed network environment (i.e. client- 
server), remote source; see Singhal paragraph [0062], lines 7-11: policy decision 
storage in local memory)) 

The terms, "first request", "second request", and "third request", is not disclosed 
within the specification or the original claims. The term "subsequent request" is 
disclosed within the specification and the original claims. These terms indicate that 
there is no distinction between request(s). All requests are equal. 

3.6 The Examiner has considered Applicant's Remarks concerning methods and 
systems for controlling access to resources. When a user attempts to access a 
resource via a remote interface, the request is initially evaluated by a source of policy 
definitions such as a policy server, and a policy decision is returned and stored in 
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memory. The remote, interface can then evaluate subsequent requests from the user 
for the resource using the stored policy decision instead of having to communicate 
again with the source for the policy decision. Accordingly, policy definitions and 
decisions are more efficiently implemented: 

After an additional analysis of the applicant's invention, remarks, and a search of 
the available prior art, it was determined that the current set of prior art consisting of 
Moriconi (20030115322), Singhal (20050021818), and Chakraborty (20040054791) 
discloses the Applicant's Invention including disclosures in Remarks dated July 19, 
2007. 

Claim Rejections r 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

5. Claims 1, 2, 4, 5, 7, 9 - 11, 13, 14, 16, 18 - 20, 22, 24, 25 are rejected under 35 
U.S.C. 103(a) as being unpatentable over Moriconi et al. (US PGPUB No. 
20030115322) in view of Singhal etal. (US Patent No. 20050021818). 

Regarding Claim 1, Moriconi discloses a method, computer-usable medium having 
computer-readable program code embodied therein for causing a computer system to 
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perform a method of controlling access to resources, said method comprising: 

b) receiving a first request for access to said resource, said first request comprising 
said requester identifying information; (see Moriconi paragraph [0050], lines 1-5: 
program, computer usable medium; paragraph [0068], lines 1-3: access request 
processed, subject or requestor identified) 

Moriconi discloses storing a policy definition for a resource in local memory, said 
policy decision based on a policy definition governing access to said resource and 
on requester identifying information provided to said source, and evaluating said 
request using said policy decision in said local memory instead of referring said 
request to said source for evaluation, (see Moriconi paragraph [0068], lines 4-9: 
process or evaluate access request; paragraph [0076], lines 16-19; paragraph 
[0024], lines 1-9: policy definition processed locally or by local security policy, policy 
definition local client security policy stored within local memory, access policy based 
on subject or requestor identification) Moriconi does not specifically disclose a 
policy decision for a resource in local memory, said policy decision received from a 
source of policy definitions, said policy decision based on a policy definition 
governing access to said resource. 
However, Singhal discloses: 

a) a policy decision for a resource in local memory, said policy decision received 
from a remote source of policy definitions, said policy decision based on a policy 
definition governing access to said remote resource; (see Singhal paragraph 
[0062], lines 7-1 1 : policy decision storage in local memory) 
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c) evaluating said first request using said policy decision in said local memory (see 
Singhal paragraph [0062], lines 7-11: storage policy decision parameter in local 
memory) 

And, Moriconi and Singhal disclose: 

d) receiving a notification from said remote source; (see Moriconi paragraph [0082], 
lines 8-13: distribute (i.e. notification) of policy information update) 

e) receiving a second request for access to said resource , said second request 
comprising said request to identifying information : and evaluating said second 
request based on said. ; (see paragraph [0068], lines 4-9: evaluate request) 

Moriconi does not specifically disclose the processing of an updated policy decision. 
However, Singhal discloses wherein said policy decision further comprises said 
notification comprising an update version of said policy decision , and storing an 
updated version of said policy decision in said local memory, (see Singhal . 
paragraph [0062], lines 7-11: local memory storage of policy (rules, decisions)) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi 
as taught by Singhal to enable the usage of a updated policy decision for a resource 
in local memory, said policy decision received from a source of policy definitions, 
said policy decision based on a policy definition governing access to said resource. 
One of ordinary skill in the art would have been motivated to employ the teachings of 
Singhal in order to enable the provisioning of better services by content providers, 
(see Singhal paragraph [0062], lines 1-6: " ... provide content providers 106, third 
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party application providers 108 and partner portals 1 10 with more information about 
the user and network capabilities to enable provision of better services, inline 
context injection is done in the HTTP header by HTTP application handler 208 ...") 

Regarding Claim 2, Moriconi discloses the method and computer usable medium of 
claims 1 , wherein said resource is affiliated with another resource, and wherein further a 
policy decision for said other resource is received from said remote source and stored in 
said local memory, (see Moriconi paragraph [0050], lines 1-5: program, computer 
usable medium; paragraph [0024], lines 1-9: local client security policy to a client, policy 
definition within local memory; paragraph [0056], lines 1-12: linked resources, policy for 
2nd resource based on 1st resource) Moriconi does not specifically disclose the 
processing of a policy decision. However, Singhal discloses wherein a policy decision 
for said other resource, (see Singhal paragraph [0062], lines 7-1 1 : local memory 
storage of policy decision) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi as 
taught by Singhal to enable the usage of a policy decision parameter within a security 
management environment. One of ordinary skill in the art would have been motivated 
to employ the teachings of Singhal in order to enable the provisioning of better services 
by content providers, (see Singhal paragraph [0062], lines 1-6) 

Regarding Claims 4, 13, Moriconi discloses the method of claims 1, 10 wherein said 
notification identifies resources affected by said changes, (see Moriconi paragraph 
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[0082], lines 7-1 0: only changes to policy definition are incorporated and transmitted) 

Moriconi does not specifically disclose the processing of a policy decision. However, 
Singhal discloses wherein said policy decision further comprises storing an updated 
version of said policy decision in said local memory, (see Singhal paragraph [0062], 
lines 7-1 1 : local memory storage of policy (rules, decisions)) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi as 
taught by Singhal to enable the usage of a updated policy decision for a resource in 
local memory, said policy decision received from a source of policy definitions, said 
policy decision based on a policy definition governing access to said resource. One of 
ordinary skill in the art would have been motivated to employ the teachings of Singhal in 
order to enable the provisioning of better services by content providers, (see Singhal 
paragraph [0062], lines 1-6) 

Regarding Claim 5, Moriconi discloses the method of claims 1, wherein receiving said 
notification (see Moriconi paragraph [0082], lines 8-13: distribute (i.e. notification policy 
information updates) wherein said notification also comprises said updated version of 
said policy definition in said local memory, (see Moriconi paragraph [0082], lines 1-3: 
updated version of policy definition; paragraph [0082], lines 7-13: updated version 
transmitted to clients; paragraph [0068], lines 4-9: evaluate policy information request) 

Regarding Claim 7 Moriconi discloses the method of claim 1 further comprising: 
sending a message to said remote source, said message requesting updates for policy 
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definitions stored in said local memory, (see Moriconi paragraph [0024], lines 1-9: local 
client security policy transmitted to a client, policy definition within local memory; 
paragraph [0174], lines 1-5: request to server for policy change information) Moriconi 
does not specifically disclose processing security information utilizing a policy decision 
parameter. However, Singhal discloses wherein policy decisions stored in said 
memory, (see Singhal paragraph [0062], lines 7-11: local memory storage of policy 
decision) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi as 
taught by Singhal to enable the usage of a policy decision parameter within a security 
management environment. One of ordinary skill in the art would have been motivated 
to employ the teachings of Singhal in order to enable the provisioning of better services 
by content providers, (see Singhal paragraph [0062], lines 1-6) 

Regarding Claims 9, 24, Moriconi discloses the method, computer usable medium of 
claims 1,19 wherein a condition associated with said policy definition is also received 
from said remote source and stored locally, wherein said condition is enforced locally, 
(see Moriconi paragraph [0024], lines 1-9: local client security policy transmitted to a 
client, policy definition within local memory; paragraph [0047], lines 17-20: policy 
enforced locally) 

Regarding Claims 10, 25, Moriconi discloses a method of controlling access to 
resources, said method comprising: 
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a) receiving a request for access to a resource, said request comprising requestor 
identifying information, wherein said request is referred to a source of a policy 
definition that governs access to said resource for evaluation; (see Moriconi 
paragraph [0068], lines 1-3: access request processed, subject or requestor 
identified) 

b) receiving from said source a policy decision for said resource, said policy 
decision based on said policy definition and said requestor identifying 
information; (see Moriconi paragraph [0068], lines 4-9: policy decision 
determined) and 

Moriconi discloses wherein storing said policy decision in local memory, wherein a 
subsequent request for said resource is evaluated locally using said policy decision 
stored in memory, (see Moriconi paragraph [0076], lines 16-19: policy definition in 
local memory; paragraph [0047], lines 15-20: policy definition enforced based on 
local security policy or locally) Moriconi does not specifically disclose processing 
security information utilizing a policy decision parameter. 
However, Singhal discloses: 

c) storing said policy decision in local memory, (see Singhal paragraph [0062], lines 
7-1 1 : local memory storage of policy decision) 

And, Moriconi and Singhal disclose: 

d) receiving a notification from said remote source comprising said policy decision 
has been updated, wherein a third request for access to said resource is 
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evaluated based on said notification, (see Moriconi paragraph [0082], lines 8-13: 
distribute (i.e. notification) updated policy information; paragraph [0068], lines 4- 
9: evaluate request) 

Moriconi does not specifically disclose the processing of an updated policy decision. 
However, Singhal discloses wherein said policy decision further comprises said 
notification comprising an update version of said policy decision , and evaluated 
based on an updated version of said policy decision in said local memory, (see 
Singhal paragraph [0062], lines 7-11: local memory storage of policy (rules, 
decisions)) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi 
as taught by Singhal to enable the usage of a policy decision parameter within a 
security management environment. One of ordinary skill in the art would have been 
motivated to employ the teachings of Singhal in order to enable the provisioning of 
better services by content providers, (see Singhal paragraph [0062], lines 1-6) 

Regarding Claim 11, Moriconi discloses the method and computer usable medium of 
claim 10, wherein said resource is affiliated with another resource, and wherein further a 
policy decision for said other resource is received from said remote source and stored in 
said local memory, (see Moriconi paragraph [0050], lines 1-5: program, computer 
usable medium; paragraph [0024], lines 1-9: local client security policy to a client, policy 
definition within local memory; paragraph [0056], lines 1-12: linked resources, policy for 
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2nd resource based on 1st resource) Moriconi does not specifically disclose the 
processing of a policy decision. However, Singhal discloses wherein a policy decision 
for said other resource, (see Singhal paragraph [0062], lines 7-11: local memory 
storage of policy decision) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi as 
taught by Singhal to enable the usage of a policy decision parameter within a security 
management environment. One of ordinary skill in the art would have been motivated 
to employ the teachings of Singhal in order to enable the provisioning of better services 
by content providers, (see Singhal paragraph [0062], lines 1-6) 

Regarding Claim 14, Moriconi discloses the method of claims 10, wherein receiving 
said notification (see Moriconi paragraph [0082], lines 8-13: distribute (i.e. notification) 
updated policy information) also comprises an updated version of said policy definition 
in local memory, (see Moriconi paragraph [0082], lines 1-3: updated version of policy 
definition; paragraph [0082], lines 7-13: updated version transmitted to clients; 
paragraph [0068], lines 4-9: evaluate request) 

Regarding Claim 16, Moriconi discloses the method of claim 10 further comprising: 
sending a message to said remote source, said message requesting updates for policy 
definitions stored in said local memory, (see Moriconi paragraph [0024], lines 1-9: local 
client security policy transmitted to a client, policy definition within local memory; 
paragraph [0174], lines 1-5: request to server for policy change information) Moriconi 
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does not specifically disclose processing security information utilizing a policy decision 
parameter. However, Singhal discloses wherein policy decisions stored in said 
memory, (see Singhal paragraph [0062], lines 7-11: local memory storage of policy 
decision) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi 
as taught by Singhal to enable the usage of a policy decision parameter within a 
security management environment. One of ordinary skill in the art would have been 
motivated to employ the teachings of Singhal in order to enable the provisioning of 
better services by content providers, (see Singhal paragraph [0062], lines 1-6) 

Regarding Claim 18, Moriconi discloses the method of claim 10 further comprising: 
receiving from said remote source a condition associated with said policy definition, 
wherein said condition is enforced locally, (see Moriconi paragraph [0047], lines 15-20: 
policy definition enforced based on local security policy or locally) 

Regarding Claim 19, Moriconi discloses a method, computer-usable medium having 
computer-readable program code embodied therein for causing a computer system to 
perform a method of controlling access to resources, said method comprising: 

b) receiving a first request for access to said resource, said first request comprising 
said requester identifying information; (see Moriconi paragraph [0050], lines 1-5: 
program, computer usable medium; paragraph [0068], lines 1-3: access request 
processed, subject or requestor identified) 
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Moriconi discloses storing a policy definition for a resource in local memory, said 
policy decision based on a policy definition governing access to said resource and 
on requester identifying information provided to said source, and evaluating said 
request using said policy decision in said local memory instead of referring said 
request to said source for evaluation, (see Moriconi paragraph [0068], lines 4-9: 
process or evaluate access request; paragraph [0076], lines 16-19; paragraph 
[0024], lines 1-9: policy definition processed locally or by local security policy, policy 
definition local client security policy stored within local memory, access policy based 
on subject or requestor identification) Moriconi does not specifically disclose a 
policy decision for a resource in local memory, said policy decision received from a 
source of policy definitions, said policy decision based on a policy definition 
governing access to said resource. 
However, Singhal discloses: 

a) a policy decision for a resource in local memory, said policy decision received 
from a remote source of policy definitions, said policy decision based on a policy 
definition governing access to said remote resource; (see Singhal paragraph 
[0062], lines 7-1 1 : policy decision storage in local memory) 

c) evaluating said first request using said policy decision in said local memory (see 
Singhal paragraph [0062], lines 7-11: storage policy decision parameter in local 
memory) 

And, Moriconi and Singhal disclose: 
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d) receiving a notification from said remote source that said policy decision has 
been updated; (see Moriconi paragraph [0082], lines 8-13: distribute (i.e. 
notification) updated policy information) 

e) receiving a second request for access to said first resource; and evaluating said 
second request based said notification ; (see Moriconi paragraph [0068], lines 4- 
9: evaluate request) 

Moriconi does not specifically disclose the processing of an updated policy decision. 
However, Singhal discloses wherein said policy decision further comprises said 
notification comprising an update version of said policy decision , and evaluated 
based on an updated version of said policy decision in said local memory, (see 
Singhal paragraph [0062], lines 7-11: local memory storage of policy (rules, 
decisions)) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi 
as taught by Singhal to enable the usage of a policy decision for a resource in local 
memory, said policy decision received from a source of policy definitions, said policy 
decision based on a policy definition governing access to said resource. One of 
ordinary skill in the art would have been motivated to employ the teachings of 
Singhal in order to enable the provisioning of better services by content providers, 
(see Singhal paragraph [0062], lines 1-6) 



Regarding Claim 20, Moriconi discloses the method and computer usable medium of 
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claim 19 wherein said resource is affiliated with another resource, and wherein further a 
policy decision for said other resource is received from said remote source and stored in 
said local memory, (see Moriconi paragraph [0050], lines 1-5: program, computer 
usable medium; paragraph [0024], lines 1-9: local client security policy to a client, policy 
definition within local memory; paragraph [0056], lines 1-12: linked resources, policy for 
2nd resource based on 1st resource) Moriconi does not specifically disclose the 
processing of a policy decision. However, Singhal discloses wherein a policy decision 
for said other resource, (see Singhal paragraph [0062], lines 7-11: local memory 
storage of policy decision) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi as 
taught by Singhal to enable the usage of a policy decision parameter within a security 
management environment. One of ordinary skill in the art would have been motivated 
to employ the teachings of Singhal in order to enable the provisioning of better services 
by content providers, (see Singhal paragraph [0062], lines 1-6) 

Regarding Claim 22, Moriconi discloses the computer-usable medium of claim 19 
wherein said computer-readable program code embodied therein causes said computer 
system to perform said method further comprising: sending a message to said source, 
said message requesting updates for policy definitions stored in said memory, (see 
Moriconi paragraph [0174], lines 1-5: request updates to policy definitions) Moriconi 
does not specifically disclose processing security information utilizing a policy decision 
parameter. However, Singhal discloses wherein policy decisions stored in said 
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memory, (see Singhal paragraph [0062], lines 7-1 1 : local memory storage of policy 
decision) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi as 
taught by Singhal to enable the usage of a policy decision parameter within a security 
management environment. One of ordinary skill in the art would have been motivated 
to employ the teachings of Singhal in order to enable the provisioning of better services 
by content providers, (see Singhal paragraph [0062], lines 1-6) 

6. Claims 8, 17, 23 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Moriconi-Singhal and further in view of Chakraborty et al. (US Patent No. 
20040054791). 

Regarding Claim 8, Moriconi discloses the method of claim 1 wherein said policy 
definition is valid is also received from said remote source and stored locally, (see 
Moriconi paragraph [0081], lines 1-5: policy definition is valid; paragraph [0047], lines 
15-20; paragraph [0076], lines 16-19: policy received, received and stored locally) 
Moriconi not specifically disclose processing security information utilizing a policy 
decision parameter. However, Singhal discloses wherein said policy decision, (see 
Singhal paragraph [0062], lines 7-11: local memory storage of policy decision) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi as 
taught by Singhal to enable the usage of a policy decision parameter within a security 
management environment. One of ordinary skill in the art would have been motivated 
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to employ the teachings of Singhal in order to enable the provisioning of better services 
by content providers, (see Singhal paragraph [0062], lines 1-6) 

Moriconi-Singhal does not specifically disclose an expiration time for policy 
decision. However, Chakraborty discloses wherein a period of time said policy 
information is valid, (see Chakraborty paragraph [0016], lines 4-9; paragraph [0019], 
lines 6-12: security policy information processing; paragraph [0051], lines 2-3; 
paragraph [0053], lines 5-7: policy information with time based expiration condition or 
period of time policy information valid) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi- 
Singhal as taught by Chakraborty to enable the usage of a period of time policy 
information is valid. One of ordinary skill in the art would have been motivated to 
employ the teachings of Chakraborty in order to enable the sharing of the same core 
policy library across various web servers, (see Chakraborty paragraph [0020], lines 1- 
6: " ...allows users to configure multiple instances of the same web server with an 
already installed version of the agent. Instead of reinstalling multiple copies of the 
shared library or dynamically linked library, the same core policy library is shared across 
various web servers ...") 

Regarding Claim 17, Moriconi discloses the method of claim 10 further comprising: 
receiving information that identifies said policy definition is valid, (see Moriconi 
paragraph [0081], lines 1-5: determine policy definition valid) Singhal does not 
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specifically disclose processing security information utilizing a policy decision 
parameter. However, Singhal discloses wherein said policy decision, (see Singhal 
paragraph [0062], lines 7-1 1 : local memory storage of policy decision) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi as 
taught by Singhal to enable the usage of a policy decision parameter within a security 
management environment. One of ordinary skill in the art would have been motivated 
to employ the teachings of Singhal in order to enable the provisioning of better services 
by content providers, (see Singhal paragraph [0062], lines 1-6) 

Moriconi-Singhal does not specifically disclose an expiration time for policy 
decision. However, Chakraborty discloses wherein a period of time said policy 
information is valid, (see Chakraborty paragraph [0016], lines 4-9; paragraph [0019], 
lines 6-12: security policy information processing; paragraph [0051], lines 2-3; 
paragraph [0053], lines 5-7: policy information, time based expiration condition or period 
of time policy information is valid) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi- 
Singhal as taught by Chakraborty to enable the usage of a period of time policy 
information is valid. One of ordinary skill in the art would have been motivated to 
employ the teachings of Chakraborty in order to enable the sharing of the same core 
policy library across various web servers, (see Chakraborty paragraph [0020], lines 1- 
6: " . . . allows users to configure multiple instances of the same web server with an 
already installed version of the agent. Instead of reinstalling multiple copies of the 
shared library or dynamically linked library, the same core policy library is shared across 
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various web servers ...") 

Regarding Claim 23, Moriconi discloses the computer-usable medium of claim 19 
wherein a policy definition is valid, is also received from said remote source, and stored 
locally, (see Moriconi paragraph [0024], lines 1-6: policy definition, stored locally within 
local client security policy transmitted to a client) Singhal does not specifically disclose 
processing security information utilizing a policy decision parameter. However, Singhal 
discloses wherein said policy decision, (see Singhal paragraph [0062], lines 7-1 1 : local 
memory or storage of policy decision) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi as 
taught by Singhal to enable the usage of a policy decision parameter within a security 
management environment. One of ordinary skill in the art would have been motivated 
to employ the teachings of Singhal in order to enable the provisioning of better services 
by content providers, (see Singhal paragraph [0062], lines 1-6) 

Moriconi-Singhal does not specifically disclose an expiration time for policy 
decision. However, Chakraborty discloses wherein a period of time said policy decision 
is valid, (see Chakraborty paragraph [0016], lines 4-9; paragraph [0019], lines 6-12: 
security policy information processing; paragraph [0051], lines 2-3; paragraph [0053], 
lines 5-7: policy information with time based expiration condition or period of time policy 
information is valid) 

It would have been obvious to one of ordinary skill in the art to modify Moriconi- 
Singhal as taught by Chakraborty to enable the usage of a period of time policy 
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information is valid. One of ordinary skill in the art would have been motivated to 
employ the teachings of Chakraborty in order to enable the sharing of the same core 
policy library across various web servers, (see Chakraborty paragraph [0020], lines 1- 
6) 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Carlton V. Johnson whose telephone number is 571- 
270-1032. The examiner can normally be reached on Monday thru Friday , 8:00 - 
5:00PM EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Nasser Moazzami can be reached on 571-272-4195. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
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USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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